Passwords can be reset basically as long as you keep your email. That means that you should, first and foremost, not create a new address every couple weeks and not use throwaway addresses for registering (I've met morons doing that). If you want something fresh, create an alias on the same email account and if you really want to switch providers, establish forwarding (or email fetch, your taste) and don't delete anytihng. That way, you may have had several addresses, but will always keep all access to all email.

Use a password system. With a good one (make it something like a hash of the URL except easy to "calculate" using the human mind), you can have as many as you want, one for each service, and remember only one thingy, namely that algorithm.

The usual security crap, beware of public computers, don't install malware, don't engage with phishing, don't be an idiot on the net.
Against phishing, letting your browser save the passwords (and keeping the login cookie anyway) is a fool-proof anti-phishing method.

Don't let anyone use your Steam account, watch out whom you share your library with, don't let others use your user account. It's fine to let them use your computer, but give them own non-administrative accounts. Your phone should have an encryption option for it's storage. Enable it.

It doesn't take much to stay safe. Vast majority boils down to common sense. Understand how things work, knowing what can go wrong and knowing you can prevent that is incredibly empowering.

I've been keeping my accounts for about two decades this way, no paper, nothing lost.